Skip to content

Commit

Permalink
detect/transform: handle overlapping dotprefix
Browse files Browse the repository at this point in the history
If there is a transform before dotprefix, it operates in place
in a single buffer, and must therefore use memmove instead of memcpy
to avoid UB.

Ticket: 7229
  • Loading branch information
catenacyber committed Nov 26, 2024
1 parent fccb328 commit c3a6abf
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/detect-transform-dotprefix.c
Original file line number Diff line number Diff line change
Expand Up @@ -116,8 +116,8 @@ static void TransformDotPrefix(InspectionBuffer *buffer, void *options)
return;
}

memmove(&output[1], buffer->inspect, input_len);
output[0] = '.';
memcpy(&output[1], buffer->inspect, input_len);
InspectionBufferTruncate(buffer, input_len + 1);
}
}
Expand Down

0 comments on commit c3a6abf

Please sign in to comment.